From 8bf3cae6ac89de9569a7ec629594954804a2b55a Mon Sep 17 00:00:00 2001 From: Osmium Sorcerer Date: Sat, 6 Jun 2026 02:27:32 +0000 Subject: CSP hardening: remove inline styles Similar to removal of inline scripts, everything was taken out into the CSS files, with the same styles applied there directly. This lets us use `script-src 'self'` in the CSP. Additionally, serve Golden Layout CSS locally to avoid third-party connection. --- public/client.html | 111 ++++++++--------------- public/index.html | 2 +- webAO/dom/toggleElement.js | 6 +- webAO/golden/css/goldenlayout-dark-theme.css | 1 + webAO/packets/handlers/handleFL.ts | 14 +-- webAO/packets/handlers/handlePV.ts | 5 +- webAO/styles/client.css | 131 ++++++++++++++++++++++++++- webAO/styles/master.css | 4 + 8 files changed, 184 insertions(+), 90 deletions(-) create mode 100644 webAO/golden/css/goldenlayout-dark-theme.css diff --git a/public/client.html b/public/client.html index 55214d30..1cb2b1f7 100644 --- a/public/client.html +++ b/public/client.html @@ -82,24 +82,15 @@ -

Loading

@@ -116,7 +107,7 @@
-